Agenda Hero vs SavvyCal API + MCP

Agenda Hero 18

The MCP tool definitions need a signed-in token and weren't read, so the typed-schema line is unchecked (0 of 25). No llms.txt or Markdown docs for agents (0). The help page says what each tool does and where it stops, such as read-only source events, whole-series edits and place IDs only from a lookup, which is documentation for people rather than tool descriptions (8 of 20). Typed inputs unchecked (0 of 15). Sample prompts but no documented error responses (5 of 15). Dated product posts and App Store notes, with no versioning for the connector (5 of 15).

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.

Agenda Hero 35

Read with the hosted lines, for the MCP server. A status page at status.agendahero.com (20). Its history is drawn by script and couldn't be read (5). No rate limits published for the connector or the app (0). No overload or retry guidance (0). No SLA (0). The connector is live in ChatGPT's plugin directory and not labelled beta (10).

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Agenda Hero 28

Context cost. The help page lists about seven actions, which suggests a compact toolset, but the definitions weren't read (10 of 25). Events can be read for a date range (8 of 20). Errors. The unauthenticated 401 carries a WWW-Authenticate header with resource metadata; tool errors aren't documented (5 of 20). Annotations unchecked, and removals are immediate and permanent with no review step (0 of 20). Calendar time zone is the default, and there are no SDKs, only the MCP server (5 of 15).

SavvyCal API + MCP 53

List responses are sized by limit (default 20, at most 100) with no field selection. The MCP server lists 63 tools with no documented toolset or read-only list, though a client can ask for the mcp:read scope alone (10 of 25). Cursor pagination with after, before and limit, and date and status filters on events (17 of 20). Errors name the field, the failed validation and a limit count, which an agent can act on, but a 429 carries no wait time (14 of 20). No idempotency key on booking or link creation, and the MCP annotations could not be read; the docs say the assistant confirms before cancelling, deleting or inviting (6 of 20). Creating an event needs five fields, and there is no official SDK in any language (6 of 15). 10 + 17 + 14 + 6 + 6 = 53.

Agenda Hero 49

The terms are an iubenda embed whose path iubenda's robots.txt disallows, so the licence line is unchecked and scored absent (0 of 30, unchecked). The privacy page on agendahero.com says prompts go to OpenAI or Anthropic, no data is shared for third-party model training, and Google data is removed when the person disconnects; no retention periods were readable (12 of 30). No deprecation policy or dated notices found (0 of 20). OpenAI and Anthropic are named; hosting and locations aren't (6 of 20).

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.

Agenda Hero 58

Read for a closed service. iOS 2.2.0 on 20 October 2026 and the MCP connector on 16 October (30). iOS 2.0.0 on 24 September, 2.1.0 on 29 September and 2.2.0 on 20 October, plus eight dated posts in October (20). A public product blog, a contact page and App Store notes that say what changed (8 of 15). Not in the official MCP registry, searched for agendahero and agenda-hero on 21 October 2026 (0). No package to judge (0).

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Agenda Hero 38

Credential model. OAuth with three scopes (calendars:read, events:read, events:write), PKCE S256, dynamic registration and a revocation endpoint, from Agenda Hero's own metadata (30). Least privilege. The assistant can change only calendars the person can edit and only reads events from sources, but the consent screen grants all three scopes together and deletions run with no confirmation (8 of 20). Injection. Tools return event text from schools, teams and other people's calendars and no guidance on untrusted content was found (0 of 15). No audit log or per-call view for the operator found (0 of 15). No security.txt, disclosure policy, bounty or certification found (0 of 20).

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.